CWE-918

Server-Side Request Forgery (SSRF)

Parent: CWE-441 - Unintended Proxy or Intermediary ('Confused Deputy')

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

2,750 vulnerabilities with CWE-918
CVE-2022-36663 CRITICAL
Gluu Oxauth < 4.4.1 - Server-Side Request Forgery via request_uri Parameter
CVSS 9.8
CVE-2022-31196 HIGH
databasir <= 1.0.6 - Server-Side Request Forgery via JDBC Driver File URL
CVSS 7.6
CVE-2022-2556 LOW
Mailchimp for WooCommerce <2.7.2 - SSRF
CVSS 2.7
CVE-2022-2267 MEDIUM
Mailchimp for WooCommerce < 2.7.1 - Authenticated Server-Side Request Forgery via AJAX Action
CVSS 4.3
CVE-2022-35583 CRITICAL
wkhtmltopdf 0.12.6 - Server-Side Request Forgery via iframe Source
CVSS 9.8
CVE-2022-38187 HIGH
Esri Portal <10.9.0 - Info Disclosure
CVSS 7.5
CVE-2022-35949 MEDIUM
undici <5.8.2 - Server-Side Request Forgery via pathname URL Confusion
CVSS 5.3
CVE-2022-37041 HIGH
Zimbra Collaboration Suite 8.8.15 and 9.0 - Server-Side Request Forgery via X-Forwarded-Host Header
CVSS 7.5
CVE-2022-2756 MEDIUM
Kavita < 0.5.4.1 - Server-Side Request Forgery
CVSS 6.5
CVE-2022-31132 HIGH
Nextcloud Mail < 1.12.8 - Server-Side Request Forgery via CSS Minifier
CVSS 8.3
CVE-2022-31188 HIGH
CVAT < 2.0.0 - Server-Side Request Forgery
CVSS 8.6
CVE-2022-31776 HIGH
IBM DataPower Gateway SSRF (10.0.1.0-10.0.1.8, 10.0.2.0-10.0.4.0, 10.5.0.0, 2018.4.1.0-2018.4.1.21)
CVSS 8.8
CVE-2022-36997 HIGH
Veritas NetBackup 8.1.x-8.1.2, 8.2, 8.3.x-8.3.0.2, 9.x-9.0.0.1, 9.1.x-9.1.0.1 - Arbitrary File Read, SSRF, and DoS
CVSS 7.1
CVE-2022-32457 MEDIUM
Digiwin Business Process Management < 5.8.8.1 - Unauthenticated Server-Side Request Forgery via URL Parameter
CVSS 5.3
CVE-2022-22416 MEDIUM
IBM Sterling Partner Engagement Manager <6.1.2, 6.2, 22.2 - SSRF
CVSS 5.4
CVE-2022-25801 CRITICAL
Best Practical RT for Incident Response < 4.0.3 and 5.x < 5.0.3 - Server-Side Request Forgery via Scripted Action Tools
CVSS 9.1
CVE-2022-25800 CRITICAL
Best Practical RT for Incident Response < 4.0.3 and 5.x < 5.0.3 - Server-Side Request Forgery via Whois Lookup Tool
CVSS 9.1
CVE-2022-22982 HIGH
VMware Cloud Foundation 3.0-3.10 - Server-Side Request Forgery
CVSS 7.5
CVE-2022-2339 HIGH
Nocodb - Server-Side Request Forgery
CVSS 7.5
CVE-2022-25876 MEDIUM
link-preview-js < 2.1.16 - Server-Side Request Forgery via DNS Rebinding Bypass
CVSS 6.2
CVE-2022-26135 MEDIUM
Atlassian Jira <8.13.22, <8.20.10, <8.22.4 - SSRF
CVSS 6.5
CVE-2022-0085 MEDIUM
dompdf < 2.0.0 - Server-Side Request Forgery
CVSS 5.3
CVE-2022-32995 CRITICAL
Halo CMS 1.5.3 - Server-Side Request Forgery via Template Remote Download Function
CVSS 9.8
CVE-2022-2216 CRITICAL
parse-url < 7.0.0 - Server-Side Request Forgery
CVSS 9.8
CVE-2022-1977 HIGH
WordPress Plugin <6.5.3 - Blind SSRF
CVSS 7.2
Details
Vulnerabilities 2,750
Links
MITRE CWE Entry Search this CWE With Exploits